snakekeylogger | 97d8e645f346ddaf67cbe7359d333e3d454a5f791005c829d6efc236727a774a

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2024 02:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QUOTATION_NOVQTRA071244PDF.scr
Size

1.4MB
MD5

a7eb6d75e2e1650b770659935018365b
SHA1

ea305bbda8b4a94cd46c85b322c058f52a3b41f5
SHA256

bcedd4dd1b7cc1e7ec76afadb555224ed3a5f65ef8ca9bda5b946d395a2127fb
SHA512

3487eb0baf2ecb908f2edd65049e1ed0107c318bacb85755e51aa836268f50c7695759d0e165492bc20bbe808337e36b6daf25efb5f7abf4811c16baf6291f5b
SSDEEP

24576:5eyolA3YuCbH7J2Urh6TEJ1Z3PYEAmje+LmSWGn0o5I2W+uJax08B:x3fq0UrhQEJ/MX+x0UIS

Score

10^/10

snakekeylogger keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
gator3220.hostgator.com
Port:
587
Username:
[email protected]
Password:
ABBjy5ce)hyxmj99w
Email To:
[email protected]

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral2/memory/2748-1194-0x0000000140000000-0x0000000140024000-memory.dmp	family_snakekeylogger

Snakekeylogger family
snakekeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
34	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3496 set thread context of 2748	3496	QUOTATION_NOVQTRA071244PDF.scr	91

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3496	QUOTATION_NOVQTRA071244PDF.scr
3496	QUOTATION_NOVQTRA071244PDF.scr
3496	QUOTATION_NOVQTRA071244PDF.scr
3496	QUOTATION_NOVQTRA071244PDF.scr
2748	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3496	QUOTATION_NOVQTRA071244PDF.scr
Token: SeDebugPrivilege	3496	QUOTATION_NOVQTRA071244PDF.scr
Token: SeDebugPrivilege	2748	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 2748	3496	QUOTATION_NOVQTRA071244PDF.scr	91
PID 3496 wrote to memory of 2748	3496	QUOTATION_NOVQTRA071244PDF.scr	91
PID 3496 wrote to memory of 2748	3496	QUOTATION_NOVQTRA071244PDF.scr	91
PID 3496 wrote to memory of 2748	3496	QUOTATION_NOVQTRA071244PDF.scr	91
PID 3496 wrote to memory of 2748	3496	QUOTATION_NOVQTRA071244PDF.scr	91
PID 3496 wrote to memory of 2748	3496	QUOTATION_NOVQTRA071244PDF.scr	91
PID 2748 wrote to memory of 4140	2748	aspnet_compiler.exe	92
PID 2748 wrote to memory of 4140	2748	aspnet_compiler.exe	92
PID 4140 wrote to memory of 4592	4140	cmd.exe	94
PID 4140 wrote to memory of 4592	4140	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\QUOTATION_NOVQTRA071244PDF.scr
"C:\Users\Admin\AppData\Local\Temp\QUOTATION_NOVQTRA071244PDF.scr" /S
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\Windows\system32\choice.exe
      choice /C Y /N /D Y /T 3
      4⤵
      PID:4592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2748-1194-0x0000000140000000-0x0000000140024000-memory.dmp

Filesize
144KB

Download
memory/2748-1192-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/2748-1195-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/2748-1197-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/3496-1-0x00000252EFE70000-0x00000252EFFE4000-memory.dmp

Filesize
1.5MB

Download
memory/3496-0-0x00007FFB85243000-0x00007FFB85245000-memory.dmp

Filesize
8KB

Download
memory/3496-2-0x00000252F2540000-0x00000252F2630000-memory.dmp

Filesize
960KB

Download
memory/3496-3-0x00000252F27C0000-0x00000252F28B0000-memory.dmp

Filesize
960KB

Download
memory/3496-33-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-19-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-39-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-37-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-35-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-31-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-29-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-27-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-25-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-23-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-21-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-17-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-15-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-14-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-11-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-9-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-7-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-6-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-4-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-45-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-106-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/3496-67-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-65-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-64-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-59-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-57-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-55-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-53-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-51-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-49-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-43-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-61-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-41-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-47-0x00000252F27C0000-0x00000252F28AB000-memory.dmp

Filesize
940KB

Download
memory/3496-1181-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/3496-1182-0x00000252F28B0000-0x00000252F2912000-memory.dmp

Filesize
392KB

Download
memory/3496-1183-0x00000252F2910000-0x00000252F295C000-memory.dmp

Filesize
304KB

Download
memory/3496-1184-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/3496-1185-0x00007FFB85243000-0x00007FFB85245000-memory.dmp

Filesize
8KB

Download
memory/3496-1186-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/3496-1187-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/3496-1188-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/3496-1189-0x00000252F2960000-0x00000252F29B4000-memory.dmp

Filesize
336KB

Download
memory/3496-1191-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/3496-1193-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download